I received a question as follows: Does the vendor solution need to have the ISO 27001 certification for the application itself, or just for the hosting of the platform?

In my understanding, ISO 27001 cert concerns companies/vendors and includes both solution and the hosting platform. Are they separable? In the case of SAAS solution, can I have the platform certified and the app not?


  • 2
    As far as I know you are correct, you can only certify companies and not products. And even if a company is certified, there is a statement of applicability, which clearly states which parts of the company is certified. It doesn't have to be the whole company. – Martin Weil Nov 18 '19 at 7:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.